{"id":"CVE-2025-59814","state":"PUBLISHED","title":"Unauthenticated SQL-injection in password field","description":"This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database.","publishedAt":"2025-09-25T19:29:34.809Z","updatedAt":"2025-09-29T17:25:33.798Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"NCSC-NL"},"assigner":"NCSC-NL","products":["Zenitel ICX500","Zenitel ICX510"],"affected":[{"vendor":"Zenitel","product":"ICX500","defaultStatus":"unaffected","versions":[{"version":"<1.4.3.3","status":"affected","versionType":"custom"}]},{"vendor":"Zenitel","product":"ICX510","defaultStatus":"unaffected","versions":[{"version":"<1.4.3.3","status":"affected","versionType":"custom"}]}],"references":["https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes","https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/59xxx/CVE-2025-59814.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-59814","state":"PUBLISHED","datePublished":"2025-09-25T19:29:34.809Z","dateUpdated":"2025-09-29T17:25:33.798Z","assignerShortName":"NCSC-NL","assignerOrgId":"cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39","dateReserved":"2025-09-22T10:23:28.574Z"},"containers":{"cna":{"title":"Unauthenticated SQL-injection in password field","descriptions":[{"lang":"en","value":"This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database."}],"affected":[{"vendor":"Zenitel","product":"ICX500","defaultStatus":"unaffected","versions":[{"version":"<1.4.3.3","status":"affected","versionType":"custom"}]},{"vendor":"Zenitel","product":"ICX510","defaultStatus":"unaffected","versions":[{"version":"<1.4.3.3","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes","name":"Zenitel","tags":["release-notes"]},{"url":"https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System","name":"Zenitel","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","exploitCodeMaturity":"NOT_DEFINED","remediationLevel":"NOT_DEFINED","reportConfidence":"NOT_DEFINED","temporalScore":8.8,"temporalSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"ADJACENT_NETWORK","modifiedAttackComplexity":"LOW","modifiedPrivilegesRequired":"NONE","modifiedUserInteraction":"NONE","modifiedScope":"UNCHANGED","modifiedConfidentialityImpact":"HIGH","modifiedIntegrityImpact":"HIGH","modifiedAvailabilityImpact":"HIGH","environmentalScore":8.8,"environmentalSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"NCSC-NL","orgId":"cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39","dateUpdated":"2025-09-26T05:46:25.019Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-29T17:25:21.899215Z","id":"CVE-2025-59814","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-29T17:25:33.798Z"}}]}}}